Inside Mobile-spy "Spouseware," Part 1
The mobile phone has completely changed the way people communicate. Not only can you make phone calls anywhere, at anytime, but you can also use these devices to send text messages, emails, and even surf the internet. While there is no denying the many benefits a mobile phone can provide, there are some serious concerns that also come with this technology.
The main problem is that the mobile phone can be used to facilitate nefarious activity. This can include access to explicit content online, passing love notes to a mistress, sending inappropriate text messages, and many other things. Depending on your role and relationship to the mobile device, having the ability to monitor how that device is used can be important. For example, a parent may want to monitor how their child uses their phone, as they would the household computer. Likewise, an employer might want to ensure their phones are not being used inappropriately. In these two scenarios, it is easy to see why programs like Mobile-spy and Flexispy are valuable tools for the family and workplace.
On the other hand, these same programs can also be used by untrusting or suspicious people to spy on an unsuspecting victim. In this regard, the ability to monitor the incoming/outgoing calls, SMS messages, and URLs allows a spouse or partner to dishonestly keep track of another person's phone activity. Not only is this highly unethical, but it could be illegal — especially if the phone is not owned by you. The end result is that many anti-virus vendors are including signatures for these programs in their software.
Unfortunately, the companies that make this software exploit people who want to spy on their significant others. Whether it is the "Catch Cheating Spouses" phrase on FlexiSPY.com or the more subtle "Recommended by…the Infidelity Coach" at Mobile-spy.com, it is obvious there is money to be made by marketing this type of software to insecure and untrusting people.
In this article we are going examine one such "spouseware" program from Mobile-spy. First we will tear the program apart to see how it works. Then we will demonstrate several ways that this particular program can be exploited to create a custom spyware program, spoof log results, unmask the person who installed the software, and even infect every user of their software with JavaScript malware.
What is Mobile-spy?
Mobile-spy is a software product for Windows Mobile smartphones offered at http://www.mobile-spy.com. Its primary markets are parents, employers, and suspicious spouses. From the site: "Mobile Spy is a hybrid software/service which allows you to monitor your smartphone in real time. This unique system records the activities of anyone who uses your smartphone. You install a small application onto your phone. It starts at every boot of your phone but remains stealth and does not show up in the Windows Mobile Task Manager. After the software is setup on your phone it will record an array of phone activities and then silently upload the data to your private Mobile Spy account using GPRS. When you want to view results, simply login to the Online Control Panel from any computer and enter your username and password to proceed."
To install the software the buyer needs to have physical access to the target phone. Assuming the phone is on the list of compatible devices, the only requirement is that the .NET Compact Framework is installed. Once this prerequisite is met, the software is either downloaded or copied to the phone via an ActiveSync connection and then is installed. Following a successful installation, the phone's owner will need to reboot the phone to access the setup page (Figure 1). This screen is where you enter the account information so the phone can log into the mobile-spy.com website and upload the log file.
)
Figure 1 Mobile-spy setup screen
Once the program is authenticated, it will load up the Options screen ((Figure 2). From here you can test the connection, adjust what forms of communication you want to monitor, how often the logs are uploaded, and more. After the settings are updated you can save the options and hide the program. At this point there is no obvious indication that the program is running on the device. If the phone's owner wants to review or change the settings again, they simply have to dial #123456789* and the Options page will reopen.
)
Figure 2 Mobile-spy Options window
As the target phone is used, a log file is created in the \Program Files\Smartphone directory, which will then be uploaded to mobile-spy.com. This allows the phone's owner to view the activity from any computer via a web application that is hosted at Mobile-spy.com. The web interface is fairly straightforward, as (Figure 3 illustrates.
)
Figure 3 Mobile-spy Web Application
While the vendor's website states that all logs are sent over the GPRS network, the truth is that the logs will pass over the active network connection. On most phones this will be the GPRS connection, but the logs can also be sent via a Wi-Fi connection or the ActiveSync connection. This method might eat up some bandwidth if the target phone is on a limited data plan. However, the alternate is posting logs via SMS, which can quickly get expensive.
That is mobile-spy.com in a nutshell. We will now take a deeper look into the software to see how it collects and manages the logged data.